In gymnastics, a perfect 10 gets you a gold medal. In vulnerability scoring, it gets you a holiday-weekend deadline from CISA. GitLab admins are now holding the second kind of trophy.
A Regex Walks Into a Pipeline
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, confirming that attackers are using it. The flaw affects GitLab Community and Enterprise Editions. It lets an unauthenticated attacker run arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, and the CVE record gives it a CVSS v3.1 score of 10.0.
The weakness is classified as an integer overflow (CWE-190), which GitLab attributes to insufficient regex validation. Affected releases are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, and those three versions are the fixes. Federal agencies have until November 1 to remediate, and the KEV entry also calls for forensic triage. A researcher reported the bug through GitLab's HackerOne program, and the CVE was published on October 13.
Your CI Server Holds the Keys
A compromised GitLab instance isn't just one compromised server. It's where your source code lives, where your deploy secrets sit, and where the pipelines that push code to production run. An attacker with code execution there can do the whole job: read the code, swap what ships, and grab the credentials to everything downstream. That's what makes a CI/CD bug a supply-chain problem rather than an IT ticket.
The angle most people miss is the forensic triage requirement. CISA isn't only saying "patch it." It's saying "find out whether someone already got in." The fix landed mid-month and exploitation is now confirmed, so an instance that sat unpatched for two weeks deserves a hard look at runner logs, new tokens, unexpected pipeline changes, and any commits nobody remembers making. Public reporting hasn't named the attackers or how widespread the campaign is, which is one more reason not to assume you were skipped.
A quick reality check for self-hosted teams: "we'll get to the upgrade next sprint" is how a lot of incident reports begin. If your GitLab is on the internet and on one of those branches, the sprint is now.
Update to 19.2.8, 19.3.5, or 19.4.2, rotate anything that smells like a secret, and remember that a perfect score is only good news at the Olympics.
If this one made you wonder what else in your build pipeline is trusting things it shouldn't, our free developer security checklist for defending against supply-chain attacks is a solid place to start.
Source: GBHackers